The second customer key could not use global inference profiles. Early bulk requests failed, but later checks discovered working US regional model IDs and the attacker repeated quota probing. The ensuing thirteen-hour flood included over one million successful calls, while quota throttling blocked much of the remainder. The first and second keys shared some…
Inspect the ClaimsCase · DiggingBeagle record
Wiz Case B: a separate Bedrock key received about 1.7 million calls
Wiz observed a second stolen credential used for approximately 1.7 million Bedrock calls over thirteen hours after an actor adapted requests to its permitted US regional inference profiles.
Scope
Wiz evidence concerns one customer credential; a shared reseller or original credential thief cannot be asserted from the post-flood IP overlap alone.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- confirmed in the wild
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Wiz documented a separate compromised Bedrock credential, model-profile enumeration and approximately 1.7 million calls in thirteen hours. Regional profile constraints shape the abuse; the overlap in infrastructure does not collapse the two customer incidents. Impact remains unrated because the evidence does not supply a calibrated scale for this Case.
Assessed Nov 1, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV01-BEDROCK-LLMJACK-B-1 · Wiz: Black October for AI Developer Platforms and downstream Bedrock key abuse
At a glance
Assess the reported tool or model action separately from the side effect actually observed.
Read the implicationsWiz evidence concerns one customer credential; a shared reseller or original credential thief cannot be asserted from the post-flood IP overlap alone.
Limits and uncertaintyFull account
The second customer key could not use global inference profiles. Early bulk requests failed, but later checks discovered working US regional model IDs and the attacker repeated quota probing. The ensuing thirteen-hour flood included over one million successful calls, while quota throttling blocked much of the remainder. The first and second keys shared some testing infrastructure, but they represent separate affected customer accounts and distinct volume measurements.
Regional model-profile errors became feedback for the attacker. Unauthorized probes that fail can still reveal which model identifiers and regions a stolen key may use, while later successful inference produces the measurable cost and activity. The two separate customer keys must remain separate loss and exposure populations.
Mechanism and trust boundary
- 01
Step
Claims & evidence
CLM-2026-NOV01-BEDROCK-LLMJACK-B-1Wiz observed a second stolen credential used for approximately 1.7 million Bedrock calls over thirteen hours after an actor adapted requests to its permitted US regional inference profiles.supported
Basis: reported finding
- supportsWiz: Black October for AI Developer Platforms and downstream Bedrock key abuseprimary disclosure
Wiz Black October, Case B, The Flood and The Stolen Tokens
Implications
Assess the reported tool or model action separately from the side effect actually observed.
Controls and mitigations
- Bind inference profiles to least-privileged regions, cap rapid bursts with provider-side quotas and anomaly detection, and revoke credentials on unauthorized enumeration.
Unknowns and contradictions
- Wiz evidence concerns one customer credential; a shared reseller or original credential thief cannot be asserted from the post-flood IP overlap alone.
Sources and citation
Material revision history
- Nov 1, 2026 · Canonical change recorded · new in release · revision 211